From fd0481c69b4c293c2097cfd4ac3c457ff649bd97 Mon Sep 17 00:00:00 2001 From: Michael Pursifull Date: Fri, 17 Jul 2026 18:45:15 -0500 Subject: [PATCH] ci: publish attestation bundle as release asset on alpha releases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The alpha attest job records provenance in the GitHub attestation store, which external scanners (OSSF Scorecard Signed-Releases) cannot see — the check looks for signature/provenance files among release assets. Upload the Sigstore bundle to the release (attestations.sigstore.json) so the attestation is externally visible. --- .github/workflows/ci.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8f9c491..3b09f1e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -518,7 +518,7 @@ jobs: needs.create-release.result == 'success' && (needs.sign-and-notarize.result == 'success' || needs.sign-and-notarize.result == 'skipped') permissions: - contents: read + contents: write id-token: write attestations: write runs-on: ubuntu-latest @@ -543,6 +543,18 @@ jobs: ls -la release-assets/ - name: Attest release artifacts + id: attest uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-path: 'release-assets/*' + + - name: Upload attestation bundle to release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + # Publish the Sigstore bundle as a release asset so external + # scanners (e.g. OSSF Scorecard Signed-Releases) can see it; the + # GitHub attestation store is not visible to them. + cp "${{ steps.attest.outputs.bundle-path }}" attestations.sigstore.json + gh release upload "${{ needs.build.outputs.tag }}" attestations.sigstore.json \ + --repo "${{ github.repository }}" --clobber